No. 4/2018 PuBuc EN11TIES CoRPoRATE GovERNANCE Cap. 10:31 232. An internal audit plan or activity should(a) follow a risk based approach; be infonned by the strategy and risks of the company; be agreed and approved by the audit committee; be independent of management; be an objective provider of assurance predicted on-(i) the risks that may prevent or slow down the attainment of strategic goals; (ii) whether controls are in place and functioning effectively to mitigate risks; (iii) the opportunities that will promote the attainment of strategic goals as may be identified, assessed and efTectively managed by the company's management team; (1) submit to the Board at least once a year a written assessment of the effectiveness of the company's system of internal control and risk management; (g) form an integral part of the combined assurance model as an internal assurance provider; (h) submit to the audit committee a written assessment of internal financial controls. (b) (c) (d) (e) 233. ~vianagement should specify the clements of the risk control framework. CoNTROL Principles 234. The Board should delegate to the audit committee its responsibilities of general oversight and reporting of the company's sustainability matters. 235. The financial statements should be used to provide well thought out disclosures on the company's governance and the board evaluation exercise. 236. Financial statements and other financial information included in the report should fairly present in all material respects the financial condition and results of the operations or the company. 237. The board should(a) disclose to the public, on an urgent basis, infonnation on material changes in its financial condition or operations; (b) (c) (d) if it is a listed company, prohibit the dealing in its shares by directors, officers and other selected employees for a designated period preceding the cumouncement of its tlnancial results or during any other pexiod considered sensitive, and have regard to the listing requirements of the Zimbabwe Stock Exchange rules and any other applicable rules and legislation in respect of dealing of directors; prohibit insider trading and abusive self-dealing and ensure that members of the Board and key executives disclose to the Board whether they, directly, indirectly or on behalf of third par1ies, have a material interest in any transaction or matter directly affecting the company; review transactions with related parties (including internal group transactions) in order to assess risk and ensure that the transactions are subject to appropriate restrictions (e.g. by requiring that such transactions be conducted on arm's-length terms) and that corporate or business resources of the organization are not misappropriated or misapplied; and 138